The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's implementation patterns ingest untrusted user input and interpolate it directly into prompts for various LLM tasks (e.g., intent routing, document extraction) without providing sanitization or boundary markers. This creates a surface where malicious user data could potentially influence agent actions through the interpolated prompts.\n
Ingestion points: Untrusted data enters the agent's context through parameters like inputs in metered_invoke (SKILL.md), user_message in the intent routing function (references/model-tiering.md), and inputs in the bounded_invoke middleware (references/per-tenant-budgets.md).\n
Boundary markers: The instructional code snippets lack delimiters (like triple backticks or XML tags) or system instructions designed to prevent the model from executing commands embedded within the user data.\n
Capability inventory: The skill operates with powerful tools, including Bash (specifically for Python and Redis-cli) and file Read, Write, and Edit permissions.\n
Sanitization: There is no logic demonstrated to filter, escape, or validate user inputs before they are combined with the prompt templates.

langchain-cost-tuning